No. 7 of 20 ·User and Entity Behavior Analytics Software

VbtEngine UEBA

Web · Self-hosted

Freedom report

One barScore 5.4

Free tierNo free tier on record
Open codeNo open-source code on record
Runs widely1 of 6 device platforms
DocumentedPlans, terms and facts published

VbtEngine UEBA is ranked #7 of 20 in user and entity behavior analytics software on Freedom251. It runs on Self-hosted, Web.

Compared on user and entity behavior analytics software

Deployment: on-premises
Entity coverage: users, source IPs, protocols, sessions, departments, tenants
Anomaly methods: hybrid
Response automation: automated

Best VbtEngine UEBA alternatives

See all 19

One bar Netskope One Behavior Analytics Paid plans No. 1—5.7 One bar Security Vision TIP Paid plans No. 2—5.6 One bar DTEX Insider Risk Management Paid plans No. 3—5.5 One bar Security Vision UEBA Paid plans No. 4—5.5 No signal Securonix UEBA Paid plans No. 5—5.4 No signal Varonis SSPM Paid plans No. 6—5.4

The record

Purpose: VbtEngine UEBA learns user and entity behavior to surface anomalies and insider-threat signals with a risk score.
Log sources: It uses existing FortiGate VPN and SSH logs from fw_vpn_log and fw_ssh_log, with no new agent required.
Baseline: It builds a 30-day behavioral baseline that excludes the most recent 24 hours.
Detection: The engine describes twelve anomaly types, including new source IP, unusual hour, dormant reactivation, suspected account takeover, lateral movement, and suspected brute force.
Risk scoring: Certain signals can be correlated so that two individually medium-risk signals escalate into a high-risk finding.
Noise filtering: Internal, VPN, loopback, link-local, multicast, and CGNAT addresses are excluded as location signals; two IPs in the same /24 are not treated as different locations.
Processing: Heavy log scans run in a background worker, while the main API reads a cache and does not scan fw_logs.db synchronously.
Multi-tenancy: UEBA buckets data by tenant and keeps deduplication and seven-day anomaly history separate per tenant.
SIEM integration: A brute-force lockout followed within an hour by specified UEBA anomalies can automatically open a SIEM case through sequence correlation.
Pricing and access: The UEBA page offers a demo request and does not state a price or trial terms.
Support: VbtEngine platform support is offered by email on business days, with stated support hours of weekdays 09:00–18:00 Istanbul time (GMT+3).
Maker: VBT Yazılım A.Ş. says it was established on 24 June 1993 and lists an Istanbul address.
Behavior baseline: It builds a 30-day behavioral baseline while excluding the last 24 hours.
Anomaly detection: The engine produces twelve anomaly types, including new users, new source IPs, unusual hours, volume spikes, account takeover suspicion, lateral movement and suspected brute force.

Where it ranks on Freedom251

Best User and Entity Behavior Analytics Software in 2026#7 of 20

Is VbtEngine UEBA yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote VbtEngine UEBA

Sources

vbtengine.com/en/product/ueba· checked 30 Sept 2026
vbtengine.com/en/support· checked 30 Sept 2026
vbt.com.tr/kurumsal/hakkimizda· checked 30 Sept 2026
vbtengine.com/en/product/integrations· checked 1 Oct 2026
vbtengine.com/en/product/admin-security· checked 1 Oct 2026
vbtengine.com/en/product/compliance· checked 1 Oct 2026
vbt.com.tr/en/corporate/about-us· checked 1 Oct 2026